In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
Summary: Unit 42 analyzed a July 2023 campaign, attributed by the community to the pro-Russian APT Storm-0978 (RomCom Group), that used a weaponized Word document disguised as NATO Summit talking points on Ukraine's admission to deliver an exploit chain built on the Office RCE CVE-2023-36884. During the investigation Unit 42 found a new MotW-bypass method, assigned CVE-2023-36584 (CVSS score 5), and the lure document, first submitted to VirusTotal on July 3, 2023, was flagged malicious by 27 of 62 AV engines.
What you should know: The chain leaks the victim's NTLM credentials, hostname and username to an attacker-controlled SMB server at 104.234.239[.]26, then uses a .search-ms file to extract a CHM payload into a predictable local path - so a single opened document hands over identity material and a foothold, and the MotW bypass means Protected View never fires.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-36584CVE-2023-36884
- Related
- CVE-2023-36584: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Nov 16, 2023CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jul 17, 2023Apple & Microsoft Patch Tuesday, July 2023 Edition Cyber Risks ·